cf1f27779dbe5a64dcdfd0b5d36dcea9858c0e2cd2b78e6e8aa759632c281ae5

Analysis

max time kernel
150s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 02:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Release/AdobeGenP-3.4.0.exe
Size

1.1MB
MD5

61632e53d1a8283f9365a3045fc0ae1a
SHA1

74ef571b26a91b80a087d016b388cbc1d56904f8
SHA256

8a634f215aed7e22c8b5e58ee687914ffa675b37041b6cd21e84652b96ecf9a1
SHA512

49b8e29fbfedc2311e6eabf104fb4aef1d134c6b837a62119508aa39d4142207c604692027e746711dda9993b9347784b932aae6fa25b806c704992e8acb67c1
SSDEEP

24576:6qDEvCTbMWu7rQYlBQcBiT6rprG8aSHeqtGf7oh:6TvC/MTQYxsWR7aSHeqta7o

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeGenP-3.4.0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3296	AdobeGenP-3.4.0.exe

C:\Users\Admin\AppData\Local\Temp\Release\AdobeGenP-3.4.0.exe
"C:\Users\Admin\AppData\Local\Temp\Release\AdobeGenP-3.4.0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4236,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Release\config.ini

Filesize
7KB

MD5
9b53d646dc037c366bc8563ac509201a

SHA1
df9ad80ee4c5fdd8ac267c6bb3fce3a9482cf1db

SHA256
b1abf3b6cadc5596b8c79ac9405c85eead8ba08351c6602b56260b7b321a37b8

SHA512
bcbd5136f450f855424dbe61eaa5fa508d81a515e67683bfe12452a2f417e0e208a92541fecbae3190af848ed3ee645610cf152c282297f9e7ee3f0458f6664b

Download Submit